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RELATED APPLICATIONS 

This application is a continuation-in-part of co-pending application Ser. No. 
09/847,534, filed May 1, 2001, entitled "Method and Apparatus for Correlating 
Events", and incorporated herein by reference. 

TECHNICAL FIELD 

The present invention relates to computing systems and, more particularly, 
to a language for describing templates used to collect and correlate various events 
generated throughout a computing environment. . 

BACKGROUND 

Computer systems, such as servers and desktop personal computers, are 
expected to operate without constant monitoring. These computer systems 
typically perform various tasks without the user's knowledge. When performing 
these tasks, the computer system often encounters events that require a particular 
action (such as logging the event, generating an alert for a particular system or 
application, or performing an action in response to the event). Various 
mechanisms are available to handle these events. 

A computing enterprise typically includes one or more networks, services, 
and systems that exchange data and other information with one another. The 
enterprise may include one or more security mechanisms to safeguard data and 
authenticate users and may utilize one or more different data transmission 
protocols. At any particular time, one or more networks, services or systems imay 
be down (e.g., powered down or disconnected from one or more networks). 
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